CVE-2021-24016 | THREATINT

Description

An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below allows attacker to execute arbitrary commands via crafted IPv4 field in policy name, when exported as excel file and opened unsafely on the victim host.

Reserved 2021-01-13 | Published 2021-09-30 | Updated 2024-10-25 | Assigner fortinet

LOW: 3.7CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N/E:P/RL:X/RC:X

Problem types

Execute unauthorized code or commands

Product status

FortiManager 6.4.3, 6.2.7

affected

References

fortiguard.com/advisory/FG-IR-20-190

cve.org (CVE-2021-24016)

nvd.nist.gov (CVE-2021-24016)

Download JSON

Support options

Helpdesk Chat, Email, Knowledgebase
Telegram Chat

Subscribe to our newsletter to learn more about our work.